Network Security Policy PRESENTATIONS IN NETWORK SECURITY Network Security Policy Saad Haj Bakry, PhD, CEng, FIEE Saad Haj Bakry, PhD, CEng, FIEE

Network Security Policy Objectives / Contents Network Security Profile Policy Development Framework Policy Development Process Internet Security Sources Saad Haj Bakry, PhD, CEng, FIEE

Network Security Profile Network Security Policy Network Security Profile T P O Technology Organization People Environment Sources of Challenges and Protection Measures Target of Protection Information Information Protection Technical Administrative Challenges Accidental Malicious Problems Solutions: Cost / Balance Saad Haj Bakry, PhD, CEng, FIEE

Network Security Policy The Intranet Level: “Security Policy” Profile: Basic Levels The Internet Level: World Wide Users The Extranet Level: Partners / Suppliers / Customers The Intranet Level: “Security Policy” Intranet User Level Security Saad Haj Bakry, PhD, CEng, FIEE

Network Security Policy Profile: Sublevels System Level: Organization Organization Service Level Service Application Level Application Transaction Level Security Saad Haj Bakry, PhD, CEng, FIEE

Profile: Security Problems Network Security Policy Profile: Security Problems Problem Description Accessibility Who access: system / service. Availability System / service readiness. Reliability Identity / repudiation / legal information Integrity Alteration / loss of information (&SW) Confidentiality Disclosure of private information. Trust Disaster recovery. “Cost” “Challenges” versus “Protection” Saad Haj Bakry, PhD, CEng, FIEE

Profile: Challenges / Problems / Protection Network Security Policy Profile: Challenges / Problems / Protection Issues Challenges Protection Security Technology Organization / People Environment Design Management Illegal Access Viruses Repudiation Cryptanalysis Theft Destruction Natural Professional Quality Systems Access Systems Anti-Virus Firewalls Traffic Control Cryptographic Systems Standby Systems Awareness / Rights / Practice Policy / Management Laws / Regulations: Cyber-Crime Rules Accessibility Availability Reliability Integrity Confidentiality Trust “Risk / Cost” Saad Haj Bakry, PhD, CEng, FIEE

Profile: Cryptography Systems Network Security Policy Profile: Cryptography Systems Cryptography Security Symmetric Secrete Key / Public-Private Keys Confidentiality Management: Key Distribution / Key Agreement Hash Function: Message Testing Integrity Digital Signature: Authentication of Identity Reliability All the above Time-Stamping: Non-Repudiation (Proof of Transaction) Public Key Infrastructure: Digital Certificates Security Protocols: Applications Saad Haj Bakry, PhD, CEng, FIEE

Policy Development Framework Network Security Policy Policy Development Framework Cooperative / Continuous Development Base Time Scale Priorities / Choice Risk / Cost Environment Security Profile Architecture: * Network / Services Architecture Organization Requirement Current State: * Structure / Function Tools Development Target State: * Case (*) Related Structure Saad Haj Bakry, PhD, CEng, FIEE

Policy Development Process Network Security Policy Policy Development Process Prepare “Base” Establish “Case” Investigate “Development” Identify “Target State” Implementation Testing Re-Evaluate R Cooperative Development People Involved Environment Information Organization Using Computer Tools Evaluation Methods: Risk / Cost / Priorities / Choice Practical Work Saad Haj Bakry, PhD, CEng, FIEE

Process: Choosing from Alternative Options Network Security Policy Process: Choosing from Alternative Options IDENTIFY CRITERIA / DECIDE ON WEIGHTS GET CHOICES / SET GRADES EVALUATE SCORES OTHER VIEWPOINTS L CHOICE Saad Haj Bakry, PhD, CEng, FIEE

Process: Risk (loss) v. Cost (security) Network Security Policy Process: Risk (loss) v. Cost (security) Balance Risk Cost Saad Haj Bakry, PhD, CEng, FIEE

Process: Risk / Cost Examples Network Security Policy Process: Risk / Cost Examples Issue Fact Virus Damage The damage of the “I Love Virus” (May 2000) was estimated to be “$ 10-15 billion” with the majority of the damage done in the first few hours. (The virus destroyed files and sent itself to others through MS Outlook Address Book) Spending on Data Security Estimated by “IDC” (International Data Corporation). “$ 6.2 billion” (1999) / “$ 14.8 billion” (2003) Building a “Digital Certificate Infrastructure” Estimated by “Identrus” ( Consortium of Global Financial Companies) for financial organizations to provide trusted B-to-B e-Commerce. “$ 5 – 10 million” Saad Haj Bakry, PhD, CEng, FIEE

Important “Security” Webs (1/3) Network Security Policy Important “Security” Webs (1/3) Subject Web RSA Algorithm www.rsasecurity.com PGP (Pretty Good Privacy): MIT P-K “Web of Trust” Web.mit.edu/network/pgp.html Time-stamping www.authentidate.com US Legislation in Information Security www.itaa.org/infosec Certification Authorities www.verisign.com www.thawte.com Saad Haj Bakry, PhD, CEng, FIEE

Important “Security” Webs (2/3) Network Security Policy Important “Security” Webs (2/3) Subject Web Netscape SSL: Secure Socket Layer www.netscape.com/security/index.html developer.netscape.com/tech/ security/ss1/protocol.html PCI: Peripheral Component Interconnect cards www.phobos.com/products/ infamily.htm SET: Secure Electronic Transaction www.setco.org www.visa.com www.visa.com/nt/ecomm/security/mail.html www.mastercard.com Saad Haj Bakry, PhD, CEng, FIEE

Important “Security” Webs (3/3) Network Security Policy Important “Security” Webs (3/3) Subject Web MS Authenticode msdn.microsoft.com/workshop/ security/authcode/signfaq.asp security/authcode/authwp.asp Firewalls www.interhack.net/pubs/fwfaq Kerberos www.pdc.kth.se/kth-krb Magazines www.networkcomputing.com/consensus www.scmagazine.com www.insightview.com Saad Haj Bakry, PhD, CEng, FIEE

Network Security Policy Remarks Security Profile: Basic Factors: Technology / Organization / People / Environment Levels: User / Intranet / Extranet / Internet Sublevels: Application / Service / System Challenges / Protection / Security Measures Development Framework / Process: Base: Organization / Network / Security Profile Case: Requirements / Tools / Current State Development: Risk / Cost / Priorities / Cost Target / Implementation / Testing / Cooperative Development Saad Haj Bakry, PhD, CEng, FIEE

Network Security Policy References L.A. Worbel, Disaster Recovery Planning for Telecommunications, Artech House (US), 1990. Telecommunications Management: Network Security, The National Computing Centre Limited, UK, 1992. D.Minoli, Telecommunications Technology Handbook, Artech House(US), 1991. F. Botto, Dictionary of e-Business, Wiley (UK), 2000. H.M. Deitel, P.J. Deitel, K. Steinbuhler, e-Business and e-Commerce for Managers, Prentice-Hall (USA), 2001 S.H. Bakry, F.H. Bakry, “Identifying information network profiles for planning management”, International Journal of Network Management, Vol. 10, No. 6, Nov. / Dec. 2000, pp.313-322. Saad Haj Bakry, PhD, CEng, FIEE